The Agent Skills Directory

Indirect Prompt Injection (SAFE): The skill is designed to ingest and analyze untrusted external data, specifically code and implementation plans. While this creates a theoretical surface for indirect prompt injection, it is the primary purpose of a review tool and the skill maintains a structured workflow with human-in-the-loop checkpoints.
Ingestion points: Implementation files, plan documents (plan.md), and specifications.
Boundary markers: Findings are encapsulated in specific output files and directories.
Capability inventory: File system read/write in defined workflow directories, execution of standard git and file management commands, and invocation of sub-agents.
Sanitization: The skill relies on the LLM's inherent reasoning and specific architectural instructions to distinguish between code-to-be-reviewed and instructions.
Command Execution (SAFE): The skill uses shell commands for repository state discovery (git log) and directory management (ls, mkdir). These operations are constrained to the project's working directory and do not involve administrative privileges or risky execution patterns.
Remote Code Execution (SAFE): No remote downloads or execution of external scripts (e.g., via curl | bash) were identified. Sub-agent invocations use local filesystem paths which are expected within the skill's deployment environment.

technical-review